CISA slashes patch deadlines to 72 hours as AI exploits like Mythos and GPT-5.4-Cyber surge. Learn how to secure your infrastructure now.
Why 72 Hours Changes the Patch Calculus
CISA’s 72-hour patching mandate exists because the window between “vulnerability disclosed” and “weaponized at scale” has collapsed. AI-powered exploits such as Mythos and GPT-5.4-Cyber accelerate reconnaissance, payload generation, and targeting. Defenders who still plan remediations in weeks are planning for a threat model that no longer matches how attacks actually unfold.
Seventy-two hours is not a suggestion to “try harder.” It is a fixed operational budget: detect, assess, test, deploy, and verify before automated exploit chains do the same work against you. Teams that treat patching as a monthly maintenance chore will miss that budget. Teams that treat it as an incident-response timeline have a path that works.
Build a Patch Pipeline That Fits the Clock
You cannot invent 72 hours of process when the clock is already running. Prepare the pipeline in advance so a critical advisory becomes a well-rehearsed sequence instead of a scramble.
- Maintain a current inventory of internet-facing and high-value systems, with owners and change windows already defined.
- Pre-stage emergency change authority so security can approve high-severity remediations without multi-day committee delay.
- Keep golden images, container base layers, and package mirrors ready so rebuilds are minutes, not discovery projects.
- Automate apply-and-reboot paths for critical CVEs on tiers that can tolerate brief disruption, with rollback snapshots in place.
- Define “mitigate first” fallbacks—WAF rules, network isolation, feature flags, or temporary service disablement—when a full patch cannot land inside the window.
Run dry drills against fictional high-severity advisories. If your first real 72-hour clock is also the first time you discover who owns a forgotten bastion host, you have already lost time you cannot recover.
Prioritize What AI Exploits Hit First
Not every system deserves equal urgency inside a 72-hour window. AI-assisted attackers favor surfaces that are remote, unauthenticated or weakly authenticated, and widely deployed. Put edge services, VPN and identity gateways, mail and collaboration endpoints, and public APIs at the front of the queue. Internal tooling that never leaves a trusted network can wait if capacity is scarce—but document that choice and revisit it when lateral movement risk is high.
For each critical asset, know the difference between “patched,” “mitigated,” and “accepted risk.” A temporary network block that removes exposure can satisfy the spirit of the deadline when a vendor package is not yet available. Permanent acceptance of unpatched critical exposure should be rare, time-boxed, and visible to leadership—not a quiet backlog item.
Measure Readiness, Not Just Compliance
Meeting CISA’s mandate in practice means measuring cycle time from advisory to verified fix on the assets that matter. Track mean time from severity assignment to deploy, percentage of critical assets remediated inside 72 hours, and how often you relied on mitigations instead of patches. Those metrics expose bottlenecks—slow change boards, missing inventory, fragile CI/CD—before an AI-driven exploit wave finds them for you.
Secure infrastructure under this pressure is less about new products and more about boring discipline: inventory you trust, automation you rehearse, and clear authority to act when Mythos-class tooling compresses attacker timelines. Seventy-two hours is short only if your organization still thinks in release calendars. Treat patching as continuous operations, and the mandate becomes an achievable SLA rather than a recurring crisis.